Editor's Blog: Biometric replacement for chip and pin technology

Biometric replacement for chip and pin technology

14 September, 2007

The technology exists for using fingerprints for transactional authentication but the psychological barriers to the technology's implementation remain.

The overwhelming majority of Britons surveyed by CPP were in favour of biometric technology replacing the relatively new but now commonplace chip and pin devices embedded in payment cards, as reported in today's Guardian newspaper. Clearly, technological progress is not an obstacle but the psychological barrier remains large.

Fingerprinting in particular is something that has deeply rooted associations with ink blotters and charge rooms. Fingerprints, as we all know, are unique and although they are no more unique than a PIN, we don't leave our PINs lying around every time we touch something so there is the inevitable big brother fears that will be very hard to overcome within a largely sceptical populace.

TSSI, a fingerprint biometrics specialist, nonetheless believes that this will be overcome in the near future and that fingerprint authentication will replace chip and pin within a decade. One means of stepping over the barrier, argues TSSI, is to hold the fingerprint template on the card and convince users that the model of their fingerprint is no more detached from them than the end of their finger. However, for this argument to wash, there would need to be a very convincing piece of PR.

It is true that most biometric templates don't store an actual image like the ink prints in the collators filing cabinet, that would be far too cumbersome and not particularly useful. They're stored as an algorithm generated unique number occupying a small number of bytes on a very small card chip but does that make people feel any less vulnerable than if there was a more obvious image of all their whirls and loops adjacent to the mug shot on their driving license? Probably not and the reason is that the unique string of numbers that defines them has to be compared to something in order to authenticate which means that their identity is stored somewhere on a server and is therefore vulnerable.

At this point, TSSI would probably scream "Yes, just like a PIN and nobody objects to that!". True, but change banks and you change your PIN but your iris, fingerprint, vascular configuration and face are uniquely personal and that's the stumbling block.

Biometric technologies are without doubt the way forward and a staggering 80% of the UK are behind it if it improves their collective security. In the CIS countries where public sensibilities account for rather less than in Europe and the USA, biometric facial recognition puts dozens of hardened criminals behind bars every month as they try to get through borders or apply for false documentation so the technology can clearly improve security. However, we can't ignore the psychological barriers and need to do more to make the technology less threatening to those who it is trying to protect.